IMHO, there are 2 types of requests and their handlers that deal with sessions.
Ones that need a session but can actually trigger its creation such as a request to /login of a flowManager.
The other type of a request is the one that requires an already existing session and perhaps requires that session to be valid based on some sort of criteria. For example the upcoming /update of the flowManager will need an existing user logged in session to be handled correctly.